keith-portfolio/docs/windows-server-homelab.md

Windows Server / Active Directory Homelab

Objective

Build a self-contained Windows Server 2022 Active Directory environment to practice the day-to-day tasks a Help Desk / Junior SysAdmin role actually asks for: domain join, user and group management, OU design, SMB file services, NTFS permissions, DNS, time synchronization, and the troubleshooting loop when something breaks.

Everything on this page is from the real lab on my workstation. Nothing is fabricated.

Architecture

Three virtual machines on VMware Workstation Pro 17, plus an OPNsense firewall VM that sits between the server segment and a separate client segment. A Windows Server 2022 domain controller runs AD DS, DNS, and PDC Emulator duties for the forest; a member server runs SMB file services; a Windows 11 client is domain-joined.

Systems

System	OS	Role	Address	Purpose
DC01	Windows Server 2022 Standard	Domain controller	192.168.31.10	AD DS, DNS, PDC Emulator, Schema Master, Global Catalog
FILE01	Windows Server 2022 Standard	Member server	192.168.31.20	SMB file services
WIN11-01	Windows 11 Education	Domain client	192.168.31.x (DHCP, VMnet8)	Domain-joined workstation
OPNSENSE	FreeBSD / OPNsense	Firewall / router	VMnet8 ↔ VMnet2	Separates server and client segments

Active Directory

• Forest / Domain: ad.bytegeist.lab
• NetBIOS: BGLAB
• Forest and Domain functional level: Windows2016
• FSMO roles: all five held by DC01.ad.bytegeist.lab
• Global Catalog: DC01

Verified with Get-ADDomain, Get-ADForest, and Get-ADDomainController.

DNS

AD-integrated primary zones on DC01:

• ad.bytegeist.lab
• _msdcs.ad.bytegeist.lab
• Three default reverse-lookup zones

Clients resolve the domain through DC01. The PDC Emulator (DC01) now synchronizes time externally from time.windows.com, pool.ntp.org, and time.nist.gov — a fix I applied during this audit (see Problems and Fixes).

Organizational units

ad.bytegeist.lab/
├── ByteGeist/
│   ├── Groups
│   ├── Servers
│   ├── Workstations
│   └── Users/
│       ├── HR
│       ├── IT
│       └── Sales
└── Domain Controllers

Users and groups

Seven lab user accounts distributed across HR, IT, and Sales OUs. All are lab accounts — no production identities or real personal data.

OU	Users
HR	jwilson, ldavis
IT	bsmith, kcasko, sjohnson
Sales	mbrown, tmiller

Seven global security groups under OU=Groups,OU=ByteGeist:

Accounting · Help Desk · HR Employees · IT Employees · Management · Sales Employees · VPN Users

Groups are the access-control building block the lab uses — accounts never get rights directly on resources; groups do.

File services

FILE01 publishes one departmental share:

Share	Path	Share-level ACL	NTFS ACL
IT	C:\Shares\IT	Domain Admins = Full; IT Employees = Change	IT Employees = Modify (explicit); SYSTEM / Administrators = Full (inherited); Users = ReadAndExecute + CreateFiles + AppendData

Role-based access via group membership: only members of BGLAB\IT Employees get write access to the IT share, with a conservative share-level cap at Change (no share-level Full for regular users). HR and Sales shares aren't published yet; they're planned work.

Client domain join

WIN11-01 is a domain-joined Windows 11 Education client on the lab NAT network (VMnet8). After the NIC was moved off a bridged physical-LAN adapter and DNS was pointed at DC01, the machine-account secure channel was repaired and verified: Test-ComputerSecureChannel returns True, nltest /dsgetdc:ad.bytegeist.lab locates DC01 (PDC/GC/KDC/DNS flags), and domain authentication succeeds (bglab\administrator). Full before/after detail is in the audit log.

Networking

• VMnet8 (NAT, 192.168.31.0/24) — hosts DC01, FILE01, and OPNsense's WAN interface.
• VMnet2 (host-only, 192.168.254.0/24) — OPNsense LAN segment, intended home for domain clients.
• OPNsense is the lab's router/firewall between those segments. The current topology still has servers on VMnet8 rather than behind OPNsense's LAN — honest trade-off I kept so audit traffic stays uncomplicated during build-out.

Validation tests

Run from DC01 as BGLAB\Administrator, output captured to transcripts on the host:

• Get-ADDomain, Get-ADForest, Get-ADDomainController — forest/domain/role data.
• Get-ADOrganizationalUnit -Filter * — OU inventory.
• Get-ADUser -Filter * + Get-ADGroup -Filter * — identity inventory.
• Get-ADComputer -Filter * -Properties OperatingSystem, LastLogonDate — domain members and freshness.
• Get-DnsServerZone — zone list.
• dcdiag /q — DC health (silent = healthy after the SystemLog fix).
• repadmin /replsummary — replication (clean on a single-DC forest).
• w32tm /query /source and /status — time hierarchy, verified moving from Local CMOS Clock to time.windows.com (stratum 5).
• Invoke-Command FILE01 { Get-SmbShare | Get-SmbShareAccess ; Get-Acl } — share and NTFS evidence.
• Test-ComputerSecureChannel on FILE01 → True.

Problems found

1. PDC time source was Local CMOS Clock. On a Windows forest the PDC Emulator is the authoritative time source; every member chains off it. If it drifts, Kerberos tickets outside the 5-minute skew window fail — a classic Help Desk "I can't log in" root cause.
2. Stale dcdiag SystemLog failure from an unexpected shutdown on 2026-08-07.
3. My daily account (keith) was a standard Domain User and couldn't WinRM into FILE01 for remote auditing (correct behavior — only Domain Admins are in the server's local Administrators by default).
4. WIN11-01's NIC had drifted to bridged mode, severing its path to DC01.
5. Topology placement: DC01 and FILE01 sit on NAT (VMnet8) rather than behind OPNsense's LAN, so OPNsense doesn't see server-to-server east-west traffic. Honest reality, not a bug.

Fixes performed

• Set external NTP on the PDC: w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update, Restart-Service W32Time, w32tm /resync /rediscover. Verified: w32tm /query /source now returns time.windows.com,0x9, stratum 5.
• Confirmed the stale unexpected-shutdown event was the source, cleared the lab System log, and re-ran dcdiag /q — clean. For production, preserve evidence first with wevtutil epl System <path>.evtx before clearing.
• Added keith to Domain Admins as a lab-maintenance shortcut during this audit. That is intentionally documented as a hardening gap, not a best practice. The target state is a separate named administrative account and a non-privileged daily workstation account.

Client restoration (completed 2026-10-03, VMware GUI + guest PowerShell):

• Removed WIN11-01 snapshots, virtual TPM, and vmx encryption.
• Switched WIN11-01's network adapter from Bridged to NAT (VMnet8).
• Renewed DHCP, pointed DNS at 192.168.31.10, ran Test-ComputerSecureChannel -Repair — returns True; nltest locates DC01 with full PDC/GC/KDC/DNS flags.

Security considerations

• Lab is isolated behind VMware NAT. No inbound exposure to the host network or the internet.
• Audit transcripts live on the host under D:\Repos\ad-lab\transcripts\, not inside a VM.
• No passwords, DSRM, krbtgt, or SIDs are captured in any artifact linked from the portfolio.
• Lab AD is deliberately separate from any production or hybrid identity; nothing in ad.bytegeist.lab has internet-facing roles.

Skills demonstrated

Windows Server 2022 administration · Active Directory Domain Services · DNS · OU and group design · users and groups · SMB file services · NTFS and share permissions · PowerShell (Get-AD*, Invoke-Command, w32tm, Get-SmbShareAccess, Get-Acl) · VMware Workstation Pro 17 · OPNsense routing and segmentation lab design · WinRM remoting · structured troubleshooting · writing honest audit documentation.

Future improvements

• Create a separate named administrative account, remove daily-user Domain Admin membership, and use least-privilege workstation sign-in.
• Disable inherited BUILTIN\Users access on the IT folder and apply explicit NTFS ACLs for administrators and the intended department group.
• Move DC01 and FILE01 behind OPNsense (VMnet2) so firewall rules actually see server-side traffic — foundation for the Net+/Sec+ firewall drills in my opnsense-lab-networking skill.
• Publish HR and Sales shares with the same RBAC pattern already proven on the IT share.
• Add a first GPO (desktop wallpaper or password policy) linked to OU=Users,OU=ByteGeist.
• Enable the AD Recycle Bin and run user-delete / restore drills.
• Build out baseline / baseline-post-drills snapshots on all three VMs for repeatable break/fix practice.